Matt Lenhard has published an investigation into a grey market in China where resellers pool API keys to sell LLM access at a fraction of official prices. These operators use open source tools like one-api and new-api to aggregate credentials obtained through free trial abuse, unprotected support bots, or stolen credit cards. Buyers purchase these discounted tokens to bypass geo-restrictions or collect data for model distillation, creating a supply chain that thrives on exploiting unprotected endpoints.
The existence of this marketplace highlights a critical failure in how current API security models handle key management. Vendors must implement strict spending caps that automatically disable access once a dollar threshold is reached, rather than relying on post-hoc fraud detection. Without these controls, any new unprotected endpoint immediately becomes profitable for attackers who can resell the resulting tokens.
* Resellers primarily operate within China using open source proxy software.
* Acquisition methods include free trial abuse and chargeback attacks.
* Buyers seek cheap access to bypass restrictions or train models.
